From c23693238e26096a6f86f01de2ae3979023f4d73 Mon Sep 17 00:00:00 2001 From: tabudz Date: Sun, 8 Mar 2026 22:51:13 +0800 Subject: [PATCH] avformat/aadec: Check for scanf() failure Fixes: use of uninitialized variables Fixes: blank.aa Found-by: Chamal De Silva Signed-off-by: Michael Niedermayer --- 3rdparty/ffmpeg/libavformat/aadec.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/3rdparty/ffmpeg/libavformat/aadec.c b/3rdparty/ffmpeg/libavformat/aadec.c index 266a8e85..917371b0 100644 --- a/3rdparty/ffmpeg/libavformat/aadec.c +++ b/3rdparty/ffmpeg/libavformat/aadec.c @@ -78,6 +78,7 @@ static int aa_read_header(AVFormatContext *s) AADemuxContext *c = s->priv_data; AVIOContext *pb = s->pb; AVStream *st; + int ret; /* parse .aa header */ avio_skip(pb, 4); // file size @@ -121,7 +122,10 @@ static int aa_read_header(AVFormatContext *s) } if (!strcmp(key, "HeaderKey")) { // this looks like "1234567890 1234567890 1234567890 1234567890" av_log(s, AV_LOG_DEBUG, "HeaderKey is <%s>\n", val); - sscanf(val, "%u%u%u%u", &header_key_part[0], &header_key_part[1], &header_key_part[2], &header_key_part[3]); + ret = sscanf(val, "%u%u%u%u", &header_key_part[0], &header_key_part[1], &header_key_part[2], &header_key_part[3]); + if (ret != 4) + return AVERROR_INVALIDDATA; + for (idx = 0; idx < 4; idx++) { AV_WB32(&header_key[idx * 4], header_key_part[idx]); // convert each part to BE! }